What is the best way to create a secure channel?
Could some token (feed.example.com/user_private?user=1&token=XXXXXXXXXXX) be okay or some other more suitable solutions?
Although I have little to offer on this subject, you may find the following article useful:
Private RSS feeds: security support in aggregators
It offers a summary of the various clients of the RSS feeds (they may be a little dated by now). Comments may also be helpful.
Use basic authentication.
http://username: password@feed.example.com /user_private
(Not all channel readers support this.)